npmreport

npm gives maintainers mechanisms to verifiably establish how a package was published.

Staged publishing
Published through npm's staged flow, prepared and reviewed before it goes live. npm docs ↗
Trusted publisher
Published from CI over OIDC, with no long-lived npm token to leak or steal. npm docs ↗
Provenance
A signed link from the published package back to the exact source commit and build. npm docs ↗
None
No verifiable signal. The release rests on the maintainer's account and token alone, so a compromise there can ship malware unnoticed.

In the summary, staged publishing and trusted publisher both count as strong trust; provenance is a weaker positive; none is the one to check.

Audit of vercel, generated . This is a read-only snapshot.
Run your own audit →

Audit of vercel

Re-run this audit
Tracking daily next

Progress over time

Strong trust
20.4% (39) staged or trusted
Any trust
21.5% (41) incl. provenance
No trust signal
78.5% (150) no trust metadata detected
Strong trust Any trust No trust signal
0%50%100%8/248/309/39/169/2910/710/16
  1. 41/191 any trust
  2. 41/188 any trust
  3. ...
    40/187 any trust
  4. 40/187 any trust
  5. 40/187 any trust
  6. 40/187 any trust
  7. 40/187 any trust
  8. ...
    40/187 any trust
  9. ...
    40/186 any trust
  10. 40/186 any trust
  11. 40/186 any trust
  12. ...
    37/186 any trust
  13. 37/179 any trust
  14. 37/179 any trust
  15. ...
    37/179 any trust
  16. 37/179 any trust
  17. 37/179 any trust
  18. 37/179 any trust
  19. ...
    37/179 any trust
  20. ...
    37/179 any trust
  21. 38/178 any trust
  22. 38/178 any trust
  23. 38/178 any trust
  24. 38/178 any trust
  25. ...
    38/178 any trust
  26. ...
    38/178 any trust
  27. ...
    38/178 any trust
  28. ...
    38/178 any trust
  29. ...
    38/178 any trust
  30. 37/178 any trust
  31. ...
    37/178 any trust
  32. 37/177 any trust
  33. ... [viewing]
    37/177 any trust
    1. [viewing]
  34. 37/176 any trust
  35. 37/176 any trust
  36. 37/176 any trust
  37. 37/176 any trust
  38. 36/176 any trust
In scope
177
Staged publish
0
Trusted publisher
34
Provenance only
3
No trust signal
140
Deprecated latest
8
177 packages · click a column to sort
Package trust level report
ai7.0.85trusted publisherGitHub Actions23,560,904—
libfx0.0.7trusted publisherGitHub Actions4,750—
run2.1.0trusted publisherGitHub Actions83,981—
@vercel/sdk1.28.25trusted publisherGitHub Actions467,481—
vercel59.10.0noneGitHub Actions3,807,338—
@vercel/express5.0.0noneGitHub Actions3,465,160—
@vercel/go8.0.0noneGitHub Actions3,717,402—
@vercel/nestjs5.0.0noneGitHub Actions3,324,428—
@vercel/static-build7.0.0noneGitHub Actions3,705,609—
@vercel/koa5.0.0noneGitHub Actions3,200,402—
@vercel/redwood7.0.0noneGitHub Actions3,701,623—
@vercel/fastify5.0.0noneGitHub Actions3,333,861—
@vercel/next9.0.0noneGitHub Actions3,762,668—
@vercel/elysia5.0.0noneGitHub Actions3,332,524—
@vercel/build-utils14.7.0noneGitHub Actions4,968,735—
@vercel/hono5.0.0noneGitHub Actions3,477,577—
@vercel/rust6.0.0noneGitHub Actions3,331,773—
@vercel/h35.0.0noneGitHub Actions3,375,412—
@vercel/node10.0.0noneGitHub Actions4,465,116—
@vercel/cervel0.1.57noneGitHub Actions3,375,711—
@vercel/hydrogen6.0.0noneGitHub Actions3,690,372—
@vercel/ruby7.0.0noneGitHub Actions3,706,637—
@vercel/gatsby-plugin-vercel-builder2.2.50noneGitHub Actions3,696,036—
@vercel/remix-builder10.0.0noneGitHub Actions3,692,693—
@vercel/python11.0.0noneGitHub Actions3,713,794—
@vercel/container5.0.0noneGitHub Actions2,316,424—
@vercel/backends5.0.0noneGitHub Actions3,345,178—
@vercel/fs-detectors7.1.5noneGitHub Actions260,368—
@vercel/connect2.0.1noneGitHub Actions366,560—
@vercel/client18.2.22noneGitHub Actions41,650—
@vercel/vc-native-linux-x6459.10.0noneGitHub Actions1,474,775—
@vercel/vc-native59.10.0noneGitHub Actions2,037—
@vercel/vc-native-linux-arm6459.10.0noneGitHub Actions116,372—
@vercel/vc-native-darwin-x6459.10.0noneGitHub Actions82,537—
@vercel/vc-native-darwin-arm6459.10.0noneGitHub Actions297,134—
@vercel/sandbox3.2.1trusted publisherGitHub Actions4,340,199—
sandbox4.2.1trusted publisherGitHub Actions3,032,268—
@vercel/sandbox-mock3.2.1trusted publisherGitHub Actions13,938—
@vercel/slack-bolt1.6.4trusted publisherGitHub Actions48,936—
@vercel/geistdocs1.25.2noneGitHub Actions38,194—
@vercel/config0.7.0noneGitHub Actions313,221—
create-v0-sdk-app3.0.6trusted publisherGitHub Actions481—
v03.0.6trusted publisherGitHub Actions17,124—
@vercel/queue0.5.1noneGitHub Actions1,353,436—
@vercel/static-config3.4.3noneGitHub Actions4,333,642—
@vercel/react-router1.3.6noneGitHub Actions131,338—
@vercel/schedules0.0.0nonevercel-release-bot481—
agent-browser0.35.1trusted publisherGitHub Actions1,360,414—
@vercel/frameworks3.33.0noneGitHub Actions810,611—
@vercel/flags-core1.8.0trusted publisherGitHub Actions618,755—
@vercel/agent-eval2.2.1trusted publisherGitHub Actions118,320—
next16.3.3trusted publisherGitHub Actions55,288,719—
workflow4.8.5trusted publisherGitHub Actions1,054,894—
@vercel/og1.0.2noneGitHub Actions1,895,966—
streamdown2.6.0trusted publisherGitHub Actions6,546,104—
satori0.33.4trusted publisherGitHub Actions3,448,419—
@vercel/agent-readability0.6.0noneGitHub Actions77,955—
@vercel/oidc3.8.5noneGitHub Actions29,335,595—
@vercel/cli-config0.2.4noneGitHub Actions6,993,737—
@vercel/cli-auth0.3.5noneGitHub Actions3,143,714—
@vercel/python-analysis0.14.0noneGitHub Actions3,558,653—
@vercel/functions3.9.5noneGitHub Actions6,356,081—
@vercel/aws0.2.12noneGitHub Actions105—
@vercel/oidc-aws-credentials-provider3.3.5noneGitHub Actions302,736—
@vercel/kms0.1.1noneGitHub Actions148—
@vercel/webpack-asset-relocator-loader1.11.0trusted publisherGitHub Actions313,300—
@vercel/nft1.11.0trusted publisherGitHub Actions9,506,766—
remote-components0.4.15noneGitHub Actions17,351—
mcp-handler2.1.1trusted publisherGitHub Actions938,147—
@vercel/routing-utils6.5.0noneGitHub Actions1,116,352—
@vercel/ncc0.45.0trusted publisherGitHub Actions1,041,360—
@vercel/edge1.3.3noneGitHub Actions764,999—
@vercel/detect-agent1.2.5noneGitHub Actions3,782,676—
@vercel/firewall1.2.5noneGitHub Actions169,252—
@vercel/blob2.8.0trusted publisherGitHub Actions6,380,659—
@vercel/edge-config1.5.1trusted publisherGitHub Actions1,044,557—
@vercel/global-config1.5.1trusted publisherGitHub Actions120,127—
@vercel/global-config-fs0.1.0noneandybitz204,469—
flags4.3.0trusted publisherGitHub Actions1,130,914—
@vercel/related-projects1.1.1noneGitHub Actions72,754—
@vercel/passport1.0.1noneGitHub Actions26,378—
@vercel/gatsby-plugin-vercel-analytics1.0.12noneGitHub Actions3,319,559—
@vercel/error-utils2.2.1noneGitHub Actions4,659,678—
@vercel/cli-exec1.0.1noneGitHub Actions5,797,131—
v0-sdk0.16.7trusted publisherGitHub Actions35,681—
@vercel/vc-native-win32-x6458.4.0trusted publisherGitHub Actions497—
@vercel/toolbar0.2.7noneGitHub Actions457,920—
@vercel/microfrontends2.4.0trusted publisherGitHub Actions943,420—
@vercel/prepare-flags-definitions0.4.0trusted publisherGitHub Actions3,057,030—
@vercel/error0.0.2noneGitHub Actions7—
@vercel/otel2.1.3trusted publisherGitHub Actions2,314,224—
experimental-ash0.64.1noneGitHub Actions2,003—
create-experimental-ash-agent0.7.0noneGitHub Actions1—
next-forge6.0.3trusted publisherGitHub Actions375—
@vercel/vclaw0.3.10trusted publisherGitHub Actions5—
mixpart0.0.6noneGitHub Actions2,117,222—
@vercel/connex0.0.11noneGitHub Actions4—
@vercel/next-browser0.7.1nonejudegao22,527—
@vercel/ai-sdk-openai-websocket-fetch1.0.0nonevercel-release-bot6,251—
@vercel/stega1.1.0nonevercel-release-bot2,499,363—
@vercel/analytics2.0.1nonevercel-release-bot6,007,596—
ai-elements1.9.0trusted publisherGitHub Actions89,539—
@vercel/fun1.3.1nonevercel-release-bot3,494,602—
@vercel/speed-insights2.0.0nonevercel-release-bot3,955,368—
@vercel/cosmosdb-server1.0.1nonevercel-release-bot206,183—
botid1.5.11nonevercel-release-bot729,978—
@vercel/nextdocfs0.5.1nonejudegao3—
@vercel/kv20.0.19nonecramforce161—
@vercel/dream0.4.0noneGitHub Actions4—
@vercel/beautiful-mermaid0.1.5nonejohnphamous5,551—
@vercel/mcp-adapter0.3.2provenancevercel-release-bot65,139—
@vercel/create-dream0.2.2noneadriancooney_vercel3—
@vercel/dream-init0.2.2noneadriancooney_vercel3—
@vercel/agent-eval-playground0.1.3trusted publisherGitHub Actions1,288—
@vercel/introspection0.0.13provenancevercel-release-bot165,218—
@vercel/v00.0.1-alpha.1nonefernandorojo7—
@vercel/before-and-after0.0.4nonejamesvclements3,104—
@vercel/sandbox-cli1.1.1nonevercel-release-bot2,012DEPRECATED
@vercel/examples-ui2.0.4nonevercel-release-bot1,095—
react-chatgpt-hooks0.0.1nonequuu1—
@vercel/platforms1.0.0nonehaydenbleasel113—
@vercel/ade0.0.24nonerobpruzan7—
mcp-to-ai-sdk0.1.1nonevercel-release-bot91—
@vercel/remix-run-dev2.16.7nonevercel-release-bot6,015—
@vercel/remix2.16.7nonevercel-release-bot42,971—
@vercel/repository-dispatch-status0.0.1nonevercel-release-bot5—
@vercel/repository-dispatch-checkout0.0.1nonevercel-release-bot6—
@vercel/ai-sdk-gateway0.1.10nonevercel-release-bot114DEPRECATED
@vercel/repository-dispatch0.1.0nonevercel-release-bot52—
@vercel/flags3.1.1nonevercel-release-bot79,075DEPRECATED
@vercel/sqs-consumer5.7.0nonemglagola21—
@vercel/devlow-bench0.3.5provenancevercel-release-bot2,643—
@vercel/kv3.0.0nonevercel-release-bot435,393DEPRECATED
@vercel/postgres-kysely0.10.0nonevercel-release-bot2,495DEPRECATED
@vercel/postgres0.10.0nonevercel-release-bot375,249DEPRECATED
@vercel/style-guide6.0.0nonevercel-release-bot342,238—
@vercel/remote-nx2.0.0nonevercel-release-bot17,888—
@vercel/fetch7.0.0nonevercel-release-bot515,154—
@vercel/visual-editing0.0.1nonevercel-release-bot4—
@vercel/ai-utils0.0.2nonejaredpalmer39—
@vercel/edge-config-fs0.1.0nonevercel-release-bot828,081—
@vercel/remix-entry-server0.1.1nonevercel-release-bot207—
@vercel/node-bridge4.0.1nonevercel-release-bot36,931—
@vercel/algolite0.3.0-canary.1noneofhouse8—
@vercel/experimental-nft-next-plugin0.0.1nonevercel-release-bot12—
@vercel/fetch-cached-dns2.1.2nonevercel-release-bot338,553—
@vercel/remote-rush1.0.1nonevercel-release-bot135,000—
@vercel/remote1.0.1nonevercel-release-bot153,105—
@vercel/webpack-nft0.0.14nonevercel-release-bot11—
@vercel/nft-next-plugin0.0.13nonevercel-release-bot7—
@vercel/experimental-nft0.0.4nonevercel-release-bot10—
@vercel/experimental-nft-win32-x640.0.4nonevercel-release-bot9—
@vercel/experimental-nft-darwin-arm640.0.4nonevercel-release-bot10—
@vercel/experimental-nft-darwin-x640.0.4nonevercel-release-bot9—
@vercel/experimental-nft-linux-x640.0.4nonevercel-release-bot10—
@vercel/wireguard0.0.7noneemeraldsanto11—
@vercel/examples-ui-svelte0.1.16nonegbibeaulaviolette5—
@vercel/satori-node0.0.22nonestyfle6—
@vercel/satori-core0.0.22nonestyfle10—
@vercel/edge-jest-environment0.12.4nonekikobeats4—
@vercel/edge-runtime0.12.4nonekikobeats39DEPRECATED
@vercel/edge-vm0.12.4nonekikobeats45—
@vercel/edge-types0.12.4nonekikobeats3—
@vercel/edge-primitives0.12.4nonekikobeats75—
@vercel/edge-format0.12.2nonekikobeats49—
@vercel/format0.11.0nonekikobeats4—
@vercel/fetch-retry5.1.3noneethan_arrowood350,854—
@vercel/mdx-deck-theme0.3.1nonedav-is6—
@vercel/edge-functions-ui0.2.1nonelfades2,299—
async-sema3.1.1noneleerobinson9,784,143—
@vercel/tracing-js0.5.1nonestyfle37DEPRECATED
@vercel/git-hooks1.0.0noneleerobinson25,380—
@vercel/cgi1.0.7nonezeit-bot2—
@vercel/docs-generator0.2.0nonequietshu7—
@vercel/integration-utils0.6.5-canary.0nonetootallnate9—
vercel-client1.0.0noneleo0—
vc0.1.4nonelepture513—